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Prepared Remarks for CPPA Stakeholder Session - May 5, 2022 


Good afternoon CPPA board members and staff, my name is David LeDuc. I’m the Vice 
President for Public Policy at the Network Advertising Initiative (NAI). 


The NAI is the leading self-regulatory organization for advertising technology. For over 20 
years, we have promoted digital advertising by maintaining and enforcing high standards 
for the collection and use of consumer data among our member companies. 


We appreciate the opportunity to provide input prior to the development of draft 
implementing regulations for the CPRA. 


With five comprehensive state consumer privacy laws expected to become operative in 
the next 18 months, and many more states considering new laws, we are facing an 
inconsistent set of rules that is likely to confuse consumers, and a disparate set of 
obligations that makes compliance difficult for businesses. 


We therefore urge you to seek a collaborative approach in developing implementing 
regulations, and specifically to work with other states to harmonize the requirements to 
the greatest extent possible. Colorado Attorney General Phil Weiser recently committed 
to harmonizing his state's regulations with other states, and we hope you will engage in 
dialogue with Colorado and other state enforcement officials to maximize consistency in 
the implementation of legal requirements. 


This coordinated approach can greatly benefit consumers in California and across the 
country, and businesses that need to comply with these differing laws. This will also be to 
the overall benefit of the California economy, and the U.S. economy, as the overall 
economy is increasingly data-driven. 


| will be focusing my brief remarks today on the CPRA’s requirements around opt-out 
preference signals, which generally refer to browser-based signals (either deployed 
natively or via plugins), device settings, or other mechanisms that communicate or signal 
to a business, a consumer’s choice to exercise his or her rights to opt out as provided by 
the CPRA, and potentially similar state laws. 


The NAI has a long history of promoting consumers’ ability to exercise choice over uses of 
their data for digital advertising. Enabling consumers to express their preferences and 
exercise control through easy-to-use choice mechanisms is a foundational element of 
tailored advertising that we have championed for decades. 
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The CPRA provides the opportunity for businesses to either provide for a direct opt-out 
link on their digital property, or to honor automated opt-out preference signals. While 
NAI members are already honoring direct consumer opt-outs through “do not sell” links, 
we believe that most NAI members would also honor automated opt-out preference 
signals that represent a clearly expressed choice by a consumer. 


Broad and consistent recognition of these signals would help to minimize confusion 
among consumers who deploy such mechanisms. 


Fortunately, the CPRA provides valuable protections to enable effective implementation 
of these signals, including the following: 


1. A consent requirement for consumers to enable opt-out preference signals. For 
this, the CPRA defines consent very specifically, seeking to ensure that consumers 
knowingly and intentionally turn-on an opt-out preference signal. 

2. A specific requirement for regulations to ensure that the manufacturer of a 
platform, browser or device that sends an opt-out preference signal cannot 
unfairly disadvantage another business; and 

3. Direction to the Agency to develop regulations that provide for reconciling 
differing preferences expressed by the same consumer to the same business. 


These are three critical elements to deploying Signals effectively. We urge the Agency to 
develop regulations that elaborate on these important priorities established by the CPRA, 
by doing the following: 


First, provide a requirement that any signal activated by consumers is clearly 
communicated to businesses as a consumer opt-out request, consistent with the opt-out 
rights established by the law. 


In doing this, the regulations should avoid development of prescriptive technological 
standards. Instead, they should provide room for Signal providers to customize their 
mechanism for the receiving businesses, providing for them to be turned on or off by 
consumers within a settings menu. 


Second, prevent unfair market disadvantages by establishing a process for opt-out signal 
technical and operational specifications to be submitted for review by the Agency. This 
process should also include ongoing review by the Agency, to periodically evaluate and 
test approved signals to ensure that they continue to be administered fairly. 


To assist in the review process, the Agency should seek input from stakeholders, 
particularly those businesses to which the signals are directed. 
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The Agency should refrain from seeking to promote a singular opt-out signal, and instead 
should allow for various platforms and technology providers to develop signals that work 
effectively on their platforms and for their users. 


Third, clarify that application of choices made via the Signal applies only to the browser or 
device from which such choice is made, or in some cases could be applied more broadly to 
a consumer, if that consumer is known to the entity. 


The regulations should clarify that businesses are neither required to collect additional 
data from consumers to apply the opt out more broadly, nor require steps to tie 
pseudonymous identifiers to known consumers in cases where they do not already 
perform such practices. 


Fourth, the Agency should clarify how a business may be able to prompt a user to 
disregard or override a signal, for instance, in cases where that business has obtained an 
opt-in consent to share the consumer’s data in accordance with clear terms provided by 
the business to the consumer. 


These circumstances will be very common as more and more publishers and advertisers 
seek opt-in consent to collect and share consumer data for advertising and marketing, 
among other purposes. Businesses need an effective opportunity to reconcile these 
conflicting signals, and this can be done efficiently and fairly. 


In closing, thank you again for the opportunity to provide input on this important subject. 
This is just one of many key areas where implementing regulations can help enhance 
privacy for consumers, while also streamlining compliance for businesses. We look 
forward to continuing to engage with you on this and other key aspects of CPRA 
implementation. 


